Security

An overview of how Open Home Hero protects agent and visitor data. If you need more detail for a vendor security review, contact contact@openhomehero.com.au.

Encryption in transit and at rest

All traffic to and from Open Home Hero is encrypted over HTTPS/TLS. Data at rest — agent accounts, listings, feedback, and offers — is stored in a managed Postgres database with encryption at rest, provided by our infrastructure partner Supabase.

Per-agent data isolation

Every table has database-level Row Level Security (RLS) turned on, so an agent's listings, feedback, offers and applications are only readable by that agent or their agency, as a second layer behind the application's own checks. Visitors who scan a QR code only ever receive the few details needed to show the visit page (address, agent name and contact email). Seller and landlord preferences, and everything visitors submit, stay behind the agent's login. The server also checks who is signed in on every request.

Authentication

Passwords are hashed and never stored in plain text, using Supabase Auth's industry-standard authentication, and must be at least 12 characters. Session tokens are short-lived and refreshed automatically. Agents can turn on two-step login with an authenticator app; it is required for administrator access. Deleting an account asks for the password again.

Payment data

Subscription payments are handled entirely by Stripe, a PCI DSS Level 1 certified payment processor. Card details are entered directly into Stripe's hosted checkout — they never pass through or get stored on Open Home Hero's servers.

Abuse and spam protection

Public visitor forms (feedback, offers and rental applications) are protected by Cloudflare Turnstile, a privacy-friendly CAPTCHA, plus server-side rate limiting and strict checking of every field to prevent automated abuse.

Application security

The site sends browser security headers (including a content security policy and protection against being embedded in other sites). Agency invitations only take effect when the invited person accepts, so an agency can't change another person's account or subscription without their agreement. Software dependencies are checked against known vulnerabilities before each release.

Data deletion

Agents can permanently delete their account and all associated data at any time from Settings. Visitor feedback or offers can be deleted individually by the listing agent on request. See our Privacy Policy for details.

Responsible disclosure

If you believe you've found a security vulnerability, please report it to contact@openhomehero.com.au before disclosing it publicly. We'll acknowledge reports within 2 business days.